verdaccio-plugin-secfilter

plugin for filtering packages with security purposes

Usage

• Install the plugin (имя пакета берётся из package.json)

# если вы используете локальную/форковую версию (по package.json)
npm i -g verdaccio-plugin-secfilter-fix

# или официальный пакет (при публикации в npm)
npm i -g verdaccio-plugin-secfilter

• Configure options:

You can configure rules inline in Verdaccio config or point the plugin to an external config file that will be reloaded on changes.

Inline configuration (as before):

filters:
  plugin-secfilter:
    block:
      - scope: @evil
      - package: semver
      - package: @coolauthor/stolen
        versions: '>2.0.1'
        strategy: replace

External config file (watched at runtime):

filters:
  plugin-secfilter:
    configFile: ./secfilter.yaml

Example external file secfilter.yaml:

block:
  # GHSA: GHSA-p6jq-8vc4-79f6
  - package: 'nuxt'
    versions: '>=4.0.0 <4.1.0'
    strategy: replace

  - package: 'nuxt'
    versions: '>=3.6.0 <3.19.0'
    strategy: replace

  - package: 'matrix-js-sdk'
    versions: '<38.2.0'
    strategy: replace

  - package: '@executeautomation/database-server'
    versions: '<=1.1.0'

Notes:

• versions use semver range syntax (see semver).
• strategy: block (default) removes blocked versions; replace tries to substitute blocked versions with the nearest allowed version.
• If configFile is provided, the plugin will try to load that file and watch it for changes (no Verdaccio restart required). The external file may be YAML or JSON.

Logging

• The plugin emits informational and debug logs to help verify it's working. Typical messages:
  • plugin-secfilter: loaded external config from /path/to/secfilter.yaml
  • plugin-secfilter: loaded inline config, N entries
  • plugin-secfilter: config file changed (...), reloading
  • plugin-secfilter: processing package
  • plugin-secfilter: package blocked by scope rule
  • plugin-secfilter: package fully blocked by package rule
  • plugin-secfilter: package versions changed: before=X after=Y

This helps confirm the plugin loaded rules and is actively filtering packages.

dateThreshold (DEPRECATED)

This option is deprecated and is to be used only if you need a fast solution and you are sure your security was breached recently.

filters:
  plugin-secfilter:
    dateThreshold: '2022-03-10T23:00:00.000Z'

Development

• Build

npm run build

• Pack (create local tarball for installation on a Verdaccio server)

npm run build
npm pack
# then install the .tgz on target Verdaccio server

• Tests

npm run test

Security / publishing notes

• Remove any secrets (tokens) from the repository before publishing. For example, delete skip.txt and add it to .gitignore.
• Ensure package.json fields main, types and files point to built artifacts (lib/) before publishing.

For more information about any of these commands run npm run <task> -- --help.